Coming into force on 25 May 2018, GDPR stands for General Data Protection Regulation which aims to enhance the rights of data privacy of all EU citizens. This regulation will be applied to all businesses and individuals throughout the European Union to protect them from data breach and to harmonize data privacy laws throughout the single market.

Depending heavily on personal data such as resume databases or records of employment, the recruitment industry could be under great pressure due to this change in the law for data protection.

Three key players involved in data privacy are data controller, data processor and data subject. The data controller is a person who makes decisions on how the personal data is processed and for which purpose; the data processor processes the data on behalf of the data controller; and the data subject is the person whom the personal data is about.

The infographic shows a summary of the rights and responsibility of the three parties under GDPR.

What does this change mean to the recruitment industry?

While GDPR strengthens the data privacy right of job seekers and candidates, it challenges recruiters with stricter rules on how to store and process personal data. Below is how the regulations are interpreted in employment industry.

Consent is of utmost important

HR managers and recruiting agencies will need to get consent from job seekers anytime using their personal data. Consent must be clear and explicit when requested from candidates, long and confusing terms and conditions are no longer accepted. In addition, companies needs to clarify how they will use candidate’s data and for what purpose. The pre-tick checkbox is not allowed to be turned on by default, instead candidates need to confirm their permission in writing and it is important that the company keeps them as proof of permission.

Data needs to be secured and kept for a relevant reason

Recruiters can keep candidates’ data as long as they get the permission; however, if the personal data is no longer needed, they must be deleted or anonymized. In all cases, companies cannot store sensitive data such as race, belief or health and unnecessary data which does not serve the recruitment purpose such as passport. Furthermore, candidates have the right to access, review and update their data or even request to erase their data when they are no longer interested in the company, thus, the removal should be done within four weeks.

Data privacy with job post, interview and resume

Regarding job posts, recruiters will be no longer send emails to candidates who do not subscribe to be in their mailing list. Record of the interview in note form is not required to obtain consent if it is discarded later; however, if it is part of the file or to be shared with other, then seeking permission from candidate is applicable. Recruiters can keep applicants’ CV with their clear permission; if an applicant is rejected, company must delete their data or keep them with candidate’s permission. In case a candidate wants their his or her CV to be removed, the recruiter needs to respond this request.

How can recruiting companies prepare for GDPR?

There are some steps companies need to take to be ready for GDPR. Firstly, they need to record their current process to have a complete picture of how they collect, store and use applicants’ data in the hiring process. Then they can identify where consent needs to be obtained and what information must be clarified to candidates.

If necessary, the software for storing candidates’ data need to be updated or replace to ensure the security. Terms and conditions related to data privacy also need to be reviewed. In addition, if there is international data transfer, the process must be checked whether the data importing country has adequate data protection laws.

Although GDPR challenges recruiting companies, the regulations can benefit companies from many aspects. One of the data subject’s rights is data portability which means the candidate can receive his or her personal data in machine readable format and transfer it to another recruiter, thus, it is convenient for both candidate and recruitment companies in starting a new recruitment process.

By being compliant with GDPR, companies become more reliable to applicants by empowering them with transparency, showing their responsibility with society’s concern of data security, thus, improving their business reputation.

Bibliography

EUGDPR. (n.d.). Retrieved from https://www.eugdpr.org/

Jan. (2017). Retrieved from http://recruitingdaily.com/gdpr-coming-will-help-harm-recruiting/

Wendy. (2018). Retrieved from https://blog.firefishsoftware.com/how-to-prepare-your-recruitment-agency-for-gdpr

Contact Qreer.com

Qreer.com has a database that includes candidates that studied in those universities. To be able to reach out to those candidates contact Qreer.com to discuss a possible campaign for a job position available from your company.

To see the current job openings in your field:

Welcome to Qreer

Why Europe

Products Qreer.com

European Exposure

Sourcing activities

Be ready for GDPR this upcoming May